Security in a virtualised world - moving with the days

For almost each organisation, its data is its lifeblood. Preserving the integrity is paramount, and so securing data has become among the biggest challenges of doing business within the digital age.

It hasn't always been this form, in fact. A business used to store all its important information in a physical archive with just a limited choice of people allowed access to hard copies of the info.

An archive room, if broken into, could lead to the theft of confidential data. Today, even the smallest of offices produces mountains of digital data accessed by most people who don't even necessarily should be physically found in the office.

Technology has offered businesses large and small vast opportunities, but we have to be sure we secure our most vital digital assets; while until now an outsider would have needed a crane to steal 30,000 customer details, today a hacker would not even have to leave his desk.

For the last 20-odd years, securing your digital assets has mostly meant implementing firewalls, endless rounds of anti-virus patching and hoping on intrusion detection systems to maintain out unwelcome digital visitors. With many SMEs now realising some great benefits of server and desktop virtualisation, offering staff flexibility, unlimited scalability, simplified IT, carbon footprint reduction, cost savings and more, the old security approaches are fast becoming out-dated.

Security should always be on the heart of any IT system or strategy, it can't be an afterthought. Security should act because the immune system of the virtual environment, an intrinsic portion of the complete in place of an add-on. SMEs therefore ought to throw out their old ways of thinking when addressing virtualisation.

In a virtualised environment, it now not is sensible to consider security as protecting physical IT assets. The true assets being protected â€" data, applications and operating environments â€" are actually contained within virtual machines (VMs) that move around the underlying physical infrastructure.

Security policies should be related to the virtual entity (machine, application or data centre) they usually should remain persistent because the entity migrates across physical assets. Which means that anti-virus is also implemented as a single virtual security appliance serving many virtualised end-user environments, in place of installing on each endpoint.

This works because, out of sight to the top-user, a virtualised environment is a further layer between an operating system and hardware, often called the hypervisor.

While previously the operating system handled the safety function, it's now the job of a hypervisor. The hypervisor helps manage and secure all of the components of the infrastructure, including virtualisation hosts, management servers, virtual storage and services reminiscent of authentication and monitoring.

Data and virtual machines are usually moved from one server or site to a different automatically, mostly an afternoon, counting on requirements. a specific virtual machine could be suspended for quite a number reasons, but once it's made live again, it should receive the newest security patches, otherwise it poses a risk. Virtualisation enables this, in addition to dramatically enhancing business continuity capabilities by restarting virtual machines on working servers using the newest replicated image if the underlying infrastructure fails, with none interruption to the appliance or end-user.

Advanced threats today typically breach the fringe via a weakness and bounce around contained in the virtual environment until they find what they're in search of. What this indicates is that the very best level of security is achieved by protecting each virtual entity: machine; application; and information centre.

A single management framework can then instantly detect and act upon the threat in any component of the system and will even quarantine a virtual machine that's compromised. Different levels of security could be applied to the virtual entities dependent on their importance. The web result's that as virtual machines/applications are moved across the data centre, security policies inextricably move with them.

Unfortunately, plainly many SMEs have up to now taken a slightly relaxed method to security in a trendy computing environment. a contemporary Symantec survey across 28 countries showed that on average, only 40 per cent of an SME's server environment is totally secured. Even of these businesses with "secure" virtualised servers, 78 per cent had no anti-virus protection, 48 per cent had no firewall and 74 per cent had no endpoint protection.

The undeniable fact that security aspects are so neglected by SMEs is extremely surprising, as securing your environment doesn't must be expensive and, actually, can remove much of the management burden for workers.

Products can be found that were specifically built to secure SMEs' virtual and legacy infrastructure and that supply levels of automation previously only available to enterprises at large expense. These include automatic scan and patch management of offline and online VMs that even collate updates from third-party providers, and automatic backup procedures and real-time file scanning for all threats, including spyware, adware, malware and viruses.

What's more, while high availability was previously a luxury only large enterprises were capable of afford to be certain business continuity, technology akin to virtual storage appliances and automatic site recovery tools now also enable SMEs to enjoy these benefits at a fragment of the price of traditional methods.

If your organisation has already made the 1st steps into the cloud, there's also no reason you mustn't be secure. Any concerns over the safety of embracing the general public cloud might be dispelled by selecting cloud service providers which have adopted an open approach and constructed their offerings with virtualised security inbuilt at every level.

On the opposite hand, in case your organisation has established its own internal or private cloud, you'll want to put money into technology that permits you to manage and secure all the virtual infrastructure, from automated patch management and helpdesk ticket management to software licence and hardware asset management â€" end to finish from a single web interface.

By adopting a personal cloud approach built on open standards of VM formats and open management and control interfaces ensures that complete compatibility may be achieved with external cloud service providers. With this compatible, hybrid cloud approach, virtual entities can easily move, in addition to their security and compliance attributes, from the personal to the general public domain, and vice versa.

Security is the stick that has historically been used to hit virtualisation and, more recently, cloud computing. Because we've got worked see you later in a purely physical IT landscape, individuals are naturally way more comfortable after they can see and touch security devices.

Security concerns only need worry organisations which have not moved with the days and glued to their out-dated processes. Just as we moved from a lock on a physical archive cupboard to encryption technology to secure digital data, we have now to go with the days again and adapt to the hot requirements of a virtual world.

While security is a hard subject for SMEs for which security requirements are often changing reckoning on business growth and strategy, it cannot be ignored. a safe virtual environment may be as secure, if no more so, than a physical one, nevertheless it needs to be on the heart of your IT infrastructure and never tacked on as an afterthought.

What is required is a wholly new option to security. Within the physical world your organisation could have got away with a lax approach, but in a dynamic virtual environment that knows no borders, carelessness can be costly.

Security doesn't must be seen as an important evil; in the course of the flexibility of a virtualised infrastructure that enables for prime levels of automation and paves the way in which towards the cloud, it could considerably simplify the management of your IT environment and become a part of your corporation growth strategy.

Joe Baguley is chief cloud technologist EMEA at VMware